WebSocketGate does not validate webtoken about sepa HOT 3 CLOSED

I've recently re-written C apis and Python apis, I never encountered the problem since all requests were answered. Any more details?

from sepa.

Sure!
As stated in the issue description, consider that you have a secure WebSocket connection with SEPA. Consequently, send on this connection the following message:

{"subscribe" : {
   "sparql" : "select * where {?vaimee ?deda ?didi}",
    "alias" : "ALL"
 }}

SEPA wrongly answers with a notification message with the results of the query. However, it should reply with an error message since the subscription request lacks the authorization field. This field is fundamental to have a valid aouth2 flow.
The expected response message should be:

{
  "error":"unauthorized_client",
  "error_description" : "Client is not authorized",
  "status_code" : 401
}

If you followed the specifications you probably didn't encountered in this issue, but still is there.
Right now every client could basically read the entire database even though is not authorized by the system.

I'll fix this issue next week.

There were also problems with token expiration, before it wasn't validated. Be careful, the 60f4922 change introduces token expiration validation. That means, if the token is expired it will be rejected and the client should renew it. This behavior was described in the various documents so your apis shouldn't be affected

from sepa.

Fixed f236823

from sepa.